What we know about you

If you run the inbox yourself

Your customers' messages, bookings and orders stay in your database. We never receive them, so we can't read or recover them. The code is open if you want to check.

Some things leave your inbox, and only for a network you switch on in Settings → Networks. None is on until you switch one on, and you can switch each off again. A network you switch on gets:

• Your inbox's address, once, so it can check your inbox's public profile, and every hour your software version, what it runs on, and how many bookings, orders, quotes and messages arrived in the last 24 hours. Counts only. With your secret key set, this hourly message is signed, and the network answers it with your own standing there.
• Every receipt your inbox signs: when a booking is confirmed or an order accepted or paid, and again when it ends (it happened, the customer did not turn up, either side cancelled, it was delivered). A receipt says which business issued it, your reference for the booking or order, what kind of promise it is, when it was due and when it was made, the amount if there is a price, and how an order was paid when your inbox knows. The customer appears as a code, never a name: an HMAC made with a key only your inbox holds, which the network can't turn back into a person, and the same customer at another business gets a different code. When the customer's assistant presented their pass, the receipt also names that presentation, one per network, so the network that issued the pass counts the outcome on that person's record; every network the receipt goes to sees these references.
• A counter-signature, if the customer's assistant signs a receipt: its signature and its public key. An assistant that keeps its key uses the same one at every business, so the receipts it signed can be linked to each other. It may also name the customer's pass, by a reference that is not the pass itself.
• A new customer's email address, when a customer books or orders with an email and their assistant carries no pass. With it go your reference for that booking or order and the name of their assistant (and a fingerprint of its public key, and its platform, when it signs). The network uses the address to give the customer a key, a secret that lets any business on that network recognise them later; your inbox emails the key to the customer as one line in your name, a code for their assistant, and names no network. Turn the line off under Customers you already know; turn the key off for a network with "Give first-time customers a key".
• A pass or a key the customer's assistant carries, only to the network that issued it, with the customer's email address when their request has one, so the network can say how that customer keeps their bookings and whether the address is theirs. An assistant that signs its requests carries a reference instead of the pass, and your inbox passes on its signature: the address, path and query of the request, a hash of what it sent, its content type, its public key and the pass references it signed. Your inbox never passes on a signature that holds a secret, or that covers any other header.

Never sent: message text, names, phone numbers, postal addresses, what was ordered, payment references.

What your inbox keeps of this, in your database: what each network said about a customer (a code for that customer at your business, and their standing) on the booking or order and on the customer; a hash of each pass it saw, to recognise it again; a network's answers for an hour, a day for "already known", filed under hashes. A key a customer's assistant presents is passed on and never stored. A new customer's key is kept sealed with your secret key until it is emailed to them, and their first pass sealed so the assistant that made the booking or order can collect it again; neither longer than seven days, and neither shown to you.

Turn a network off and nothing more is sent to it. What it already holds, it keeps under its own rules. Anyone can run a network, and one we don't run is not covered by this page: add only networks you trust.

If we host it for you

Hosting is not open yet. When it opens, you will be the controller of the data your customers send you, and we will be your processor. We will hold it on our own servers in the European Union and use it only to run the service for you. For your own account, your address, your billing and how you use the service, we will be the controller.

You will be able to export everything as a file, and delete everything, from the software without asking us. A written processing agreement will be part of the terms before the first customer is onboarded.

This website

No analytics, advertising, tracking pixels or third-party scripts, and no cookie banner, because there is nothing to consent to. Our servers keep ordinary web logs, including your IP address and the page you asked for, for a short time to keep the site up and stop abuse. Cloudflare sits in front of the site and keeps its own logs for the same reason.

If you join the waitlist or write to us, we keep your message and email address so we can answer, and use them for nothing else. Posts on the requests board are public. The email address you give there is used only to tell you when your request ships.

Your rights

Under the GDPR you can ask for a copy of what we hold about you, ask us to correct or delete it, object to what we do with it, and complain to a supervisory authority. For the network, deleting means we remove what links a record to you (your email's code, your keys and passes); the coded records of past bookings stay, because businesses' records are made of them. In Portugal that is the CNPD. Write to [email protected] and we will answer within a month.

Where we rely on legitimate interest rather than your consent, it is to keep the service running and prevent abuse, and you can object to that too.

Our network, and the customers of businesses on it

We run the network at network.surfingdog.ai. Businesses whose inbox reports to it are listed in its directory, and it keeps a record of how reliably businesses and their customers keep bookings and orders. It uses only real transactions, and it never refuses or blocks anyone: it orders its directory by rules it publishes, and each business's own rules decide what a customer's record earns them, rules that may only speed things up or bring in a person, never refuse.

What it keeps, and for how long.

• The hourly messages, with the internet address they came from, for 90 days. A business's listing (its public profile, version, whether it is answering, its counts and its standing), and snapshots of it, for good.
• Every receipt, counter-signature, and record of which business was shown which customer's standing, for good. A record that could quietly disappear would be worth nothing, so none does.
• For a customer: a record with no name, keyed by an HMAC of their email address, and an HMAC of its domain (never the address itself); the hashes of their key and passes (never the secrets, except a new customer's key and pass, kept encrypted for seven days so a retry never loses them, and a pass made from a key, kept encrypted for a day); the name, public key and platform of the assistants that carried them; and the outcomes of their bookings and orders, from receipts that name them by a code.
• Sign-in sessions for 24 hours, and emailed codes for ten minutes. A code is sent to the address as typed, and the address is not stored.

Who sees what.

• A business's standing (its score and tier, and how many promises it kept and broke) is public, in the directory. Nothing about any customer is ever in it.
• A customer's standing is seen by a business only when the customer's assistant presents their pass there. There is no way to look a person up. The business sees their tier, their score, how many promises they kept and broke and at how many businesses, since when the network has known them, whether they proved their email address, and whether their pass was used unusually. It never sees their email address or which other businesses they used, and each business gets a different code for the same person.

If you are a customer.

You never sign up. If you book or order with an email at a business on the network, you may get an email with your key. You can give it to any assistant, or ignore it. With a code sent to your address you can sign in at the network to see your record, every business that was shown it, and the passes your assistants hold; revoke a pass; replace a lost key (your record carries over); and contest an outcome you think is wrong. Or write to us.

The network's rules, in plain words and as numbers, are on the network page and at network.surfingdog.ai/v1/ranking, with every change announced fifteen days before it applies.

Changes

The date at the top shows the last change. The site is an open repository, so every edit to this page is a public commit. We will announce material changes on the blog.